🔐 Authentication, Authorization, and Accounting (AAA) App and Plugin for Caddy v2. 💎 Implements Form-Based, Basic, Local, LDAP, OpenID Connect, OAuth 2.0 (Github, Google, Facebook, Okta, etc.), SAML Authentication. MFA/2FA with App Authenticators and Yubico. 💎 Authorization with JWT/PASETO tokens. 🔐
caddy-security is a security application and set of plugins for Caddy v2, a web server, that handles user authentication and controls access to HTTP requests. It supports methods including local, LDAP, OpenID Connect, OAuth 2.0, SAML, JWT, and PASETO, and is used to protect web services behind Caddy.
This repository also configures its own agents. See what caddy-security tells them →
Skill Codex
Build or troubleshoot portal JSON/native login clients, refresh, Documents, profile and admin APIs, and public JWKS. Use for HTTP contracts; portal Caddyfile wiring belongs to configuration-authentication.
Skill Codex
Diagnose caddy-security deployment and runtime failures from configs, logs, versions, and HTTP evidence. Use for focused fixes, unresolved support handoffs, or preparing break-fix issue reports.
Skill Codex
Implement or review caddy-security Go code, Caddy modules, parsers, lifecycle, and HTTP delegation. Use for app/plugin boundaries, authcrunch integration, errors, logging, and code conventions.
Skill Codex
Configure portal cookie names, prefixes, domains, paths, attributes, and refresh overrides. Use for cookie precedence and coordination with authorization token discovery.
Skill Codex
Configure and verify optional cross-device portal login, QR activation, explicit approval, browser binding, cancellation, and lifecycle through Caddy. Native login and external provider configuration retain their own owners.
Skill Codex
Configure portal UI templates, static assets, themes, languages, links, and custom CSS/JS/HTML. Use for branding and refresh-aware templates; transform-generated links belong to user transforms.
Skill Codex
Configure portal user transforms: matchers, typed claims, role actions, conditional challenges, MFA, and deny rules. Use for authentication-time policy; stored account rules belong to configuration-users.
Skill Codex
Configure authentication portals, backend selection, redirect trust, refresh, Documents storage, and portal wiring. Delegates cookies, UI, transforms, crypto, and OIDC provider details to focused skills.
Skill Codex
Configure authorization policies, ACLs, static claims enrichment, required external decisions, bypasses, identity headers, JWT verification, remote Basic/API-key auth, SQLite API keys, and direct OAuth without a portal.
Skill Codex
Configure reusable named username/password credentials for messaging consumers, including optional domains and runtime values. LDAP bind credentials belong to identity stores.
Skill Codex
Configure portal/policy JWT keys, named access signers, strict access-token profiles, token names and lifetimes, discovery, rotation, and System API encryption keys.
Skill Codex
Mount authenticate and authorize handlers, separate portal and protected routes, align auth URLs, and preserve trusted proxy metadata. Use for path conflicts, split hosts, public JWKS, and route ordering.
Skill Codex
Configure local, LDAP or SQLite password identity stores, trusted SQLite administration, realms, databases, binds, TLS trust and group mappings. Delegates static local entries to configuration-users.
Skill Codex
Configure AuthCrunch diagnostic skip rules, Caddy credential redaction, and logger boundaries. Use for component/message filtering and safe credential diagnostics; authorization outcomes remain unchanged.
Skill Codex
Configure email, file and SQLite messaging providers, bounded delivery workers, SMTP transport, sender credentials and registration notifications.
Skill Codex
Register named OAuth clients, manage private registration storage, and configure portal OIDC providers. Owns security oauth/oidc provisioning commands; external login providers and security local are separate.
Skill Codex
Configure external OAuth/OIDC login providers, credentials, scopes, issuer/audience trust, JWKS, PKCE, portal enablement, and named pending-login storage. Named relying-party registrations and portal OPs belong to OAuth applications.
Skill Codex
Configure legacy signup and SQLite email-confirmed enrollment, portal selection, messaging, storage and recovery. OAuth client registration is separate.
Skill Codex
Configure and validate Caddy runtime placeholders, secret lookups, encoded instructions, and resolved fixtures. Use to determine which fields resolve and preserve exact values; manager blocks belong to secrets.
Skill Codex
Configure external SAML login providers, ACS/IdP URLs, metadata, signing certificates, realms, and claims. Use for Azure or generic IdPs; portal SAML SSO app providers belong to configuration-sso-app.
Skill Codex
Configure security.secrets plugins and secret lookup values for users, credentials, and crypto. Use for SQLite provisioning, static/AWS wiring, and lookup failures; runtime field support belongs to runtime resolution.
Skill Codex
Configure portal-provided SAML SSO apps, AWS role names, metadata, certificates, and PKCS8 keys. Use for sso provider blocks and their runtime limits; external SAML login providers are separate.
Skill Codex
Configure durable AuthCrunch runtime state, exclusive storage ownership, stop/start persistence, reload rejection, and recovery. Use for root state blocks and process-level restart guarantees.
Skill Codex
Configure SQLite single-use ticket login issued by a trusted application, browser binding, storage and recovery. OAuth/SAML providers have separate owners.
At most 3 mods per repository are shown here, and a mod shipped inside a plugin is left to that plugin's page — the rest are on their repository pages: